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Information Bulletin 


Title: Potential Terrorist Exploitation of Heating, 
Ventilation, and Air Conditioning (HVAC) Systems 
Date: September 23, 2004 


Warning: This document is FOR OFFICIAL USE ONLY (U//FOUO). It contains 
information that may be exempt from public release under the Freedom of Information 
Act (5 U.S.C. 552). It is to be controlled, stored, handled, transmitted, distributed, and 
disposed of in accordance with DHS policy relating to FOUO information and is not to be 
released to the public or other personnel who do not have a valid “need-to-know” without 
prior approval of an authorized DHS official. 


This is a joint DHS and FBI Bulletin. Reference FBI Intelligence Bulletin No. 149. 


ATTENTION: Homeland Security Advisors, Federal Departments and Agencies, Law 
Enforcement and First Responders, Information Sharing and Analysis Centers, and the 
Intelligence Community. 


Based on this notification, no change to the Homeland Security Advisory System (HSAS) 
level is anticipated; the current HSAS national threat level is YELLOW-ELEVATED. The 
current threat level for the financial services sectors in New York City, Northern New 
Jersey and Washington, DC is ORANGE-HIGH. 


DHS and FBI encourage recipients of this Bulletin to report information concerning 
suspicious or criminal activity to the local FBI Joint Terrorism Task Force (JTTF) — the 
FBI regional phone numbers can be found online at http://www.fbi.gov/contact/fo/fo.htm — 
and the Homeland Security Operations Center (HSOC). The HSOC can be reached via 
telephone at 202-282-8101 or by email at HSCenter@dhs.gov. For information affecting 
the private sector and critical infrastructure, contact the National Infrastructure 
Coordinating Center (NICC), a sub-element of the HSOC. The NICC can be reached via 
telephone at 202-282-9201 or via email at NICC@dhs.gov. When available, each report 
submitted should include the date, time, location, type of activity, number of people and 
type of equipment used for the activity, the name of the submitting company or 
organization and a designated point of contact (POC). 


DETAILS 


Al-Qaida and other terrorist groups have considered targeting heating, ventilation, and air 
conditioning (HVAC) systems of large commercial buildings. While the FBI and DHS possess 
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no specific information indicating a specific threat of HVAC systems in the United States being 
targeted, recipients are advised that terrorists may consider exploiting commercial air handling 
systems for dispersing chemical, biological, or other air contaminants. 


Most, if not all, commercial and public service buildings in the United States--including office 
buildings, shopping centers, transit systems, and airports--have HVAC systems. HVAC systems 
typically have one or more air-intake systems that move air through the ventilation ducting 
circuit. It is possible to introduce chemical or biological agents directly into external air-intakes 
or internal air-circulation systems. Unless the building has carbon filters (or the equivalent), 
volatile chemical agents would not be stopped and would enter the building untenanted. 
Biological agents would require HEPA type filters to stop the aerosol from entering the building 
via the vent. Placement of a device within the outlet for a single room would produce a more 
concentrated hazard in a subset of the building. 


Other scenarios involve the use of helicopters equipped with agricultural spraying equipment to 
discharge large chemical or biological contaminant clouds near external or roof-mounted air 
intakes or ventilators. Crosswinds, downdrafts from helicopter rotors, and updrafts from HVAC 
cooling fans, however, would detract from the effectiveness of a helicopter-borne attack. 
Another approach may be to locally introduce natural gas and other unidentified poisonous gases 
directly into the HVAC equipment by plumbing or direct spill. Typical contaminants might also 
include toxic gas, such as hydrogen cyanide gas or chlorine gas, or aerosolized toxins or 
bacteria, such as ricin or anthrax. Contaminants introduced in a sustained manner or in sufficient 
concentration could pose a risk of fire or explosion or create an inhalation or asphyxiation 
hazard, depending on the size of the building and proximity to introduction point. 


Terrorists have considered producing a radiological dispersal device (RDD) by burning or 
exploding a source or sources containing radioactive material. If large quantities of easily 
dispersed radioactive material were released or exploded near an HVAC intake or circulation 
system, it is possible that targeted individuals could suffer some adverse health effects. It is 
more likely, however, that damage would result from the explosion rather than from any 
radiological disbursement. 


None of these scenarios is likely to produce harmful, if not catastrophic casualties. However, the 
potential exists for causing harm to exposed persons. Also, considerable HVAC system damage 
is possible. Further, the economic consequences associated with rendering a building unusable 
during a lengthy decontamination period are potentially enormous, as evidenced in the 2001 
anthrax attacks that involved small areas of several buildings. 
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SUGGESTED PROTECTIVE MEASURES 


Facilities managers should have a current emergency plan that addresses chemical, biological, 
and radiological (CBR) attacks, know their building HVAC system vulnerabilities, and conduct 
periodic walk-through inspections of the systems for evidence of irregularities or tampering. 
Individuals developing emergency plans and procedures should recognize that there are 
fundamental differences among various CBR agents. In general, chemical agents will typically 
have a rapid onset of symptoms, while the response to biological or radiological agents can be 
delayed. Potential indicators of threats include suspicious packages or containers or unusual 
powders or liquids, droplets, mists, or clouds found near air-intake, in air-ventilation ductwork, 
and HVAC systems. 


The variety of HVAC systems in use precludes an exhaustive listing of protective measures to 
take in the event of a terrorist attack involving HVAC systems. For specific guidance, facilities 
managers should consult their system's specialist. The following protective measures do, 
however, provide facilities manager’s general guidance for immediate steps to take to limit any 
dispersal of toxins and mitigate potential impact: 


Outside Release 


e In the event that a toxic substance has been released outside the building, keep 
individuals inside the building and reduce the indoor/outdoor air exchange to prevent 
contaminated air from passing through the HVAC system--immediately shut off the air 
handling system, close all windows and doors, and turn off fans and combustion heaters. 


e Once the outdoor hazard has dissipated, open all doors and windows and turn on all fans 
to ventilate the building. 


Inside Release 


e Ifa toxic substance has been released inside a building, immediately place the air 
handling system on "full (or 100%) outside air." If advised of an in-building release of 
hydrogen cyanide gas, chlorine gases, or other toxic industrial chemicals, activate the 
water sprinklers to help wash the contaminant from the air stream. This would probably 
help for particulate aerosols like anthrax but will probably not work for vapors such as 
hydrogen cyanide gas or chlorine gas. 


e Evacuate the building in accordance with the building's emergency evacuation plan. 
Evacuation routes may be hazardous because they may take people through contaminated 
areas. It is necessary to evaluate the scenario prior to evacuating the building to prevent 
additional injuries form occurring. 
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Facilities managers should note that, unless military and commercial detectors for toxic 
chemicals and biological pathogens are connected to automated shutoff/shutdown equipment, 
they are not as effective as in-line monitors within an air handling system because their response 
time is too slow. Facilities managers should assess their building vulnerabilities to HVAC attack 
and consider installing design and equipment modifications to make external air-intakes less 
accessible. Such options could include securing ventilation intake systems with perimeter 
fencing or relocating air-intakes to an inaccessible level, installing false or decoy air-intakes, and 
camouflaging actual air-intakes. 


Law enforcement officers should take note of materials describing HVAC systems in the 
possession of individuals with no legitimate need for the materials, especially when 
accompanied by instructions and diagrams for improvised chemical or biological devices. 
Recipients should immediately report suspicious or criminal activities potentially related to 
terrorism to their local law enforcement representatives. 


Information on suspicious activities potentially related to terrorism should be forwarded 
immediately to both the local FBI JTTF and the DHS HSOC as indicated on the first page. 


For comments or questions related to the content or dissemination of this Information 
Bulletin, please contact the DHS/Information Analysis and Infrastructure Protection 
Directorate’s Requirements Division at DHS.[AIP@DHS.GOV. 
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